ScienceDaily (May 11, 2011) a new publication from the National Institute of standards technology (NIST) provides guidelines to secure the earliest steps of your computer's startup process. Known as the basic input/output system (BIOS), that underlying the system firmware – built-in hardware-computer code initializes the hardware when you switch on your computer before starting the operating system. BIOS security is a new area of focus for the NIST computer security scientists.
"By building security into the firmware, the creation of a secure system," said Andrew Regenscheid, one of the BIOS protection guidelines (NIST Special Publication 800-147). Without appropriate protections, attackers can disable systems or hide malicious software by changing the BIOS. This guide focuses on reducing the risk of unauthorized changes to the bios.
SP 800-115, designed to help manufacturers to write BIOS code provides guidelines for building features into the BIOS to help protect it from being modified or damaged by the attackers. Manufacturers routinely updating system firmware bug fix, patch vulnerabilities, new hardware support. SP 800-115 calls using encryption "digital signatures" in order to verify the BIOS updates before installation based on the current encryption of NIST guidance. The publication is only available as manufacturers begin to deploy the new generation of BIOS. "We believe that manufacturers are ready to implement these guidelines, we hope to see the products soon," said Regenscheid.
The publication also offers recommended that tight management together with the security guidelines for manufacturers. These best practices will help your managers to take advantage of the features of the BIOS when they become available.
BIOS protection guidelines, NIST SP 800-115, available at http://csrc.nist.gov/publications/nistpubs/800-147/NIST-SP800-147-April2011.pdf.
Email or share this story:
The source of the story:
The above story printed (with writers adaptations by a teamdaily science) from materials that can be by the National Institute of standards technology (NIST).
Note: If no source is cited, instead.
Disclaimer: hdioth in this article do not necessarily reflect those of his team or ScienceDaily.
